deploy: the cluster issuer is a workload issuer; --node-retention per environment

[aojea]

Found while auditing the bananas database after #701.

The testnets list the GKE service account issuer under --issuer, next to the human one (auth.sam-mesh.dev). A service account token therefore enrolls as a human: a 90-day session, and the token is accepted at /user/*. The probe and canary cronjobs enroll a fresh identity on every run, so bananas holds 19,601 admitted rows with sessions of ~2160h, none of them a member any more, and the node GC cannot touch an admitted row.

• The GKE issuer moves to --workload-issuer, which the Kubernetes guide already prescribes: 48h sessions (--workload-session-ttl) renewed with a fresh projected token, refused at /user/* and /oauth/authorize. Nothing in-cluster calls /user/* with a service account token; the probes and canaries enroll through agentmesh-node and the SDKs.
• --node-retention is rendered from a NODE_RETENTION environment variable (unset is the binary's 720h), so an environment that runs scale tests can set it to days and observe the sweep within the test window. I will set NODE_RETENTION=72h on bananas; hub keeps the default.

Verification plan: after rollout, the probe cronjobs keep passing, agentmesh_control_plane_enrolled_nodes{state="admitted"} on bananas stops growing with each probe run, and once their 48h sessions lapse plus the retention, agentmesh_control_plane_nodes_deleted_total{reason="session"} advances and agentmesh_control_plane_storage_rows{table="nodes"} (#728) shrinks.

[gemini-code-assist]

Code Review

This pull request updates the Kubernetes template for the agentmesh control plane by splitting the --issuer flag into separate --issuer and --workload-issuer arguments, and introducing a new --node-retention argument. Feedback was provided to use shell default parameter expansion for ${NODE_RETENTION} (e.g., ${NODE_RETENTION:-720h}) to prevent the container from crashing on startup if the environment variable is unset or empty.